Hudson Rock Adds PhaaS, ClickFix and C2 Threat Feeds to Cavalier
Summary
Hudson Rock says Cavalier now offers feeds for phishing-as-a-service hosts, ClickFix pages and infostealer C2 infrastructure, with indicators and host details available through REST APIs for security-team ingestion.
Key points
- The new Cavalier modules cover C2 data, ClickFix activity and phishing-as-a-service infrastructure.
- The PhaaS feed groups hosts by kit and provides domains, resolved IPs, server infrastructure and operational status.
- Hudson Rock says the feed tracks platforms including Eviltokens and Kali365, as well as the SessionSerpent campaign.
- The feed links hosting information with infostealer credential telemetry, which may help identify compromised credentials associated with a host.
- Organizations can retrieve indicators through REST API endpoints for SIEM or SOAR ingestion and use them in perimeter controls, firewalls or DNS sinks.
Article Details
- Event Type
- Hudson Rock introduced three new threat-feed modules in Cavalier: C2 Data, ClickFix, and PhaaS intelligence.
- Impact
- The feeds provide security teams visibility into infostealer C2 infrastructure, ClickFix pages, and active PhaaS hosts, including kit tags, resolved IP nodes, hosting infrastructure, and linked infostealer credential telemetry. The data can be accessed through REST API endpoints and used to help identify and block malicious infrastructure.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | garage-door-repair[.]cyou | Domain identified as infrastructure running the Eviltokens phishing kit. |
| IPV4 | 43[.]172[.]6[.]35 | IP node identified as tied to Kali365 operations. |